이 튜토리얼을 기반으로 Debian 10 시스템에 openLDAP, MIT Kerberos 및 SSD를 설치했습니다.Debian squeeze의 통합 Kerberos-OpenLDAP 제공자.
세 가지 구성 요소 각각은 자체 Proxmox LXC 컨테이너에 있습니다.
ldap: 192.168.1.120(ldap2)
Kerberos: 192.168.1.128(kerb)
SSD가 있는 클라이언트: 192.168.1.129(테스트)
IP는 DNS로 확인할 수 있습니다.
문제:
'id username'을 호출하면 결과가 나오지 않습니다.
그러나 동일한 필터를 사용하면 ldapsearch로 결과를 얻을 수 있습니다.
'id test05'(SSD 로그 수준 6) 이후 클라이언트에 로그온합니다.
==> /var/log/sssd/sssd_nss.log <==
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected!
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [nss_getby_name] (0x0400): Input name: test05
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_send] (0x0400): CR #1: New request 'User by name'
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_process_input] (0x0400): CR #1: Parsing input name [test05]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'test05' matched without domain, user is test05
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_set_name] (0x0400): CR #1: Setting name [test05]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_select_domains] (0x0400): CR #1: Performing a multi-domain search
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_domains] (0x0400): CR #1: Search will check the cache and check the data provider
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_set_domain] (0x0400): CR #1: Using domain [xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_prepare_domain_data] (0x0400): CR #1: Preparing input data for domain [xxxxxxx.net] rules
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_send] (0x0400): CR #1: Looking up [email protected]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #1: Checking negative cache for [[email protected]]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #1: [[email protected]] is not present in negative cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Looking up [[email protected]] in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Object [[email protected]] was not found in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #1: Looking up [[email protected]] in data provider
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x55bd0978aee0:1:[email protected]@xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [xxxxxxx.net][0x1][BE_REQ_USER][[email protected]:-]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55bd0978aee0:1:[email protected]@xxxxxxx.net]
==> /var/log/sssd/sssd_xxxxxxx.net.log <==
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][[email protected]]
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_attach_req] (0x0400): DP Request [Account #3]: New request. Flags [0x0001].
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [ou=users,dc=lan,dc=xxxxxxx,dc=net]
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=users,dc=lan,dc=xxxxxxx,dc=net].
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_get_generic_op_finished] (0x0400): Search result: No such object(32), no errmsg set
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sysdb_search_by_name] (0x0400): No such entry
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory)
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_done] (0x0400): DP Request [Account #3]: Request handler finished [0]: Success
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [_dp_req_recv] (0x0400): DP Request [Account #3]: Receiving request data.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #3]: Finished. Success.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::xxxxxxx.net:[email protected]] from reply table
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_destructor] (0x0400): DP Request [Account #3]: Request removed.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
==> /var/log/sssd/sssd_nss.log <==
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Looking up [[email protected]] in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Object [[email protected]] was not found in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_ncache_add_to_domain] (0x0400): CR #1: Adding [[email protected]] to negative cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/xxxxxxx.net/[email protected]] to negative cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_process_result] (0x0400): CR #1: Finished: Not found
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x55bd0978aee0:1:[email protected]@xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
ldap2 호스트의 /var/log/syslog(로그 수준이 256인 3줄만)
Jan 16 16:03:48 ldap2 slapd[238]: conn=1067 op=6 SRCH base="ou=users,dc=lan,dc=xxxxxxx,dc=net" scope=2 deref=0 filter="(&(uid=test05)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"
Jan 16 16:03:48 ldap2 slapd[238]: conn=1067 op=6 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host rhost loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey userCertificate;binary mail
Jan 16 16:03:48 ldap2 slapd[238]: conn=1067 op=6 SEARCH RESULT tag=101 err=32 nentries=0 text=
보시다시피 openLDAP 검색은
기본: ou=users,dc=lan,dc=xxxxxxx,dc=net
필터를 사용하여 호출됩니다.
(&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))
openLDAP 호스트에서 직접 이 검색을 수행하면 다음과 같은 결과를 얻습니다.
ldapsearch -Y GSSAPI -b ou=users,dc=lan,dc=xxxxxxx,dc=net "(&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))" cn uid
SASL/GSSAPI authentication started
SASL username: [email protected]
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <ou=users,dc=lan,dc=xxxxxxx,dc=net> with scope subtree
# filter: (&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))
# requesting: cn uid
#
.
# test05, users, lan.xxxxxxx.net
dn: uid=test05,ou=users,dc=lan,dc=xxxxxxx,dc=net
cn: test05
uid: test05
ldap2 호스트의 /var/log/syslog
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 fd=24 ACCEPT from IP=[::1]:37252 (IP=[::]:389)
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=0 BIND dn="" method=163
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=0 RESULT tag=97 err=14 text=SASL(0): successful result:
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=1 BIND dn="" method=163
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=1 RESULT tag=97 err=14 text=SASL(0): successful result:
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 BIND dn="" method=163
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 BIND authcid="[email protected]" authzid="[email protected]"
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 BIND dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" mech=GSSAPI sasl_ssf=256 ssf=256
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 RESULT tag=97 err=0 text=
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=3 SRCH base="ou=users,dc=lan,dc=xxxxxxx,dc=net" scope=2 deref=0 filter="(&(uid=test05)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=3 SRCH attr=cn uid
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=4 UNBIND
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 fd=24 closed
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 fd=24 ACCEPT from IP=[::1]:37254 (IP=[::]:389)
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=0 BIND dn="" method=163
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=0 RESULT tag=97 err=14 text=SASL(0): successful result:
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=1 BIND dn="" method=163
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=1 RESULT tag=97 err=14 text=SASL(0): successful result:
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 BIND dn="" method=163
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 BIND authcid="[email protected]" authzid="[email protected]"
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 BIND dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" mech=GSSAPI sasl_ssf=256 ssf=256
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 RESULT tag=97 err=0 text=
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=3 SRCH base="ou=users,dc=lan,dc=xxxxxxx,dc=net" scope=2 deref=0 filter="(&(uid=test05)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=3 SRCH attr=cn uid
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=4 UNBIND
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 fd=24 closed
내 SSSD 구성
cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam
domains = xxxxxxx.net
[nss]
debug_level = 6
override_shell = /bin/bash
filter_users = root
filter_groups = root
[pam]
offline_credentials_expiration = 60
[domain/xxxxxxx.net]
# A domain with identities provided by LDAP and authentication by Kerberos
debug_level = 6
cache_credentials = true
# -- Authentication provider --
auth_provider = krb5
krb5_server = kerb.xxxxxxx.net
krb5_realm = XXXXXXX.NET
krb5_ccachedir = /tmp
# -- Access provider --
access_provider = permit
# -- Change Password provider --
chpass_provider = krb5
# -- Identity provider --
id_provider = ldap
ldap_uri = ldap://ldap2.xxxxxxx.net
ldap_search_base = dc=lan,dc=xxxxxxx,dc=net
ldap_user_search_base = ou=users,dc=lan,dc=xxxxxxx,dc=net
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/test.xxxxxxx.net
ldap_krb5_keytab = /etc/ldap/ldap.keytab
ldap_krb5_init_creds = true
# -- SUDO provider --
sudo_provider = none
이것은 내 LDAP 구성입니다.
# config
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcAuthzRegexp: {0}"uid=ldapadm,cn=XXXXXXX.NET,cn=gssapi,cn=auth" "cn=admin,
dc=lan,dc=xxxxxxx,dc=net"
olcAuthzRegexp: {1}"uid=([^,]+),cn=gssapi,cn=auth" "uid=$1,ou=users,dc=lan,dc=
xxxxxxx,dc=net"
olcAuthzRegexp: {2}"uid=([^,]+),cn=XXXXXXX.NET,cn=gssapi,cn=auth" "uid=$1,ou
=users,dc=lan,dc=xxxxxxx,dc=net"
olcAuthzRegexp: {3}"uid=host/([^,]+).XXXXXXX.NET,cn=xxxxxxx.net,cn=gssapi,
cn=auth" "cn=$1,ou=hosts,dc=lan,dc=xxxxxxx,dc=net"
olcDisallows: bind_anon
olcLogLevel: 256
olcPidFile: /var/run/slapd/slapd.pid
olcRequires: authc
olcSaslHost: ldap2.xxxxxxx.net
olcSaslRealm: XXXXXXX.NET
olcTLSCACertificateFile: /etc/ssl/openldap/certs/ca-chain-cert.pem
olcTLSCertificateFile: /etc/ssl/openldap/certs/ldap2-server-cert.pem
olcTLSCertificateKeyFile: /etc/ssl/openldap/private/ldap2-server-key.pem
olcTLSProtocolMin: 3.1
olcToolThreads: 1
# {0}config, config
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
,cn=auth manage by * break
olcRootDN: cn=admin,cn=config
# {1}mdb, config
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=lan,dc=xxxxxxx,dc=net
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=lan,dc
=xxxxxxx,dc=net" write by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=
net" read by dn="cn=mailman,ou=vmail,ou=services,dc=lan,dc=xxxxxxx,dc=net"
read by self write by anonymous auth by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to dn.subtree="ou=vmail,ou=services,dc=lan,dc=xxxxxxx,dc=net"
by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn=mailman,ou=vmail,
ou=services,dc=lan,dc=xxxxxxx,dc=net" read by self write by anonymous auth
by * none
olcAccess: {3}to dn.subtree="cn=krb5,ou=services,dc=lan,dc=xxxxxxx,dc=net" b
y dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn=adm-srv,cn=krb5,ou
=services,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn=kdc-srv,cn=krb5,ou=serv
ices,dc=lan,dc=xxxxxxx,dc=net" read by * none
olcAccess: {4}to * by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn
=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read by self write by anonymo
us auth by * none
olcLastMod: TRUE
olcRootDN: cn=admin,dc=lan,dc=xxxxxxx,dc=net
olcRootPW: {SSHA}...
나는 지금 이틀 동안 이 문제로 어려움을 겪고 있습니다. 구글은 도움이 되지 않았습니다.
누구든지 이 문제를 해결하도록 도와줄 수 있나요?
답변1
귀하의 olcAccess 문은 너무 엄격하여 sssd에서 사용하는 주체가 귀하가 보려는 데이터를 읽는 것을 허용하지 않습니다.
문제가 되는 줄은 다음과 같습니다.
olcAccess: {4}to *
by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write
by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read
by self write
by anonymous auth
by * none
아마도 다음과 같은 것을 원할 것입니다.
olcAccess: {4}to *
by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write
by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read
by dn.one="ou=hosts,dc=lan,dc=xxxxxxx,dc=net"
by self write
by anonymous auth
by * none
이는 귀하의 olcAuthzRegexp: {3}진술이 원하는 대로 작동한다고 가정하지만 이에 대해서도 확인하겠습니다. ( kinit -k그리고 ldapwhoami -Y당신의 친구가 될 것입니다.)
를 사용하여 보다 구체적인 olcAccess를 만들 수도 있습니다 to attrs=@posixAccount,@posixGroup by ....
답변2
대답 해 주셔서 감사합니다. 너가 확실히 맞아.
로그에 인증 오류에 대한 메시지가 없기 때문에 인증 오류에 대해서는 생각하지 않았습니다.
olcAccess 문을 다음으로 변경하면
olcAccess: {4}to *
by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write
by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read
by self write
by anonymous auth
by * read <--- this works, but it is not what I want
효과가있다.
그런 다음 귀하의 제안에 따라 구성을 변경했는데 모든 것이 정상입니다. 내가 변경한 내용은 다음과 같습니다.
- olcAuthzRegexp 문을 다음으로 변경했습니다.
dn: cn=config
add: olcAuthzRegexp
olcAuthzRegexp: "uid=host/([^,]+).xxxxxxx.net,cn=gssapi,cn=auth" "cn=$1,ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net"
dn: cn=config
add: olcAuthzRegexp
olcAuthzRegexp: "uid=host/([^,]+).xxxxxxx.net,cn=XXXXXXX.NET,cn=gssapi,cn=auth" "cn=$1,ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net"
그것은매우 중요이러한 호스트 항목은 uid 항목 앞에 있습니다. 그렇지 않으면 uid 매핑을 사용하여 호스트와 일치하는 항목을 얻습니다.
- olcAccess 문을 다음으로 변경했습니다.
olcAccess: {4}to *
by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write
by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read
by dn.one="ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net" read
by self write
by anonymous auth
by * none
- DIT의 새 위치에 호스트 'test'를 추가했습니다.
dn: cn=test,ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net
cn: test
objectclass: device
objectclass: hostObject
objectclass: authorizedServiceObject
objectclass: top
authorizedService: host
host: test.nottebrok.net
description: Test Host